skysight-inc/HackerNews huggingface dataset:
>you don't choose what technologies to use

I do, at least some of the time.

>you don't pick projects that itch your creative side

Right I'm doing contract work, so actually I do tend to pick the interesting projects. Before that I had a job where I specified the technology that I was using -- and that everyone else had to use. Before that I picked a job that used technology I wanted to be using. And so on...I haven't been "forced" to use a technology that I didn't think appropriate for a long time (unless you count the idiot decisions by Google and Apple to use Java and Objective C, respectively, but I've been minimizing my contamination by both).

And it was exactly passion and an urge to learn, just as the guy described in the article, that enabled me to be in this position. My contract work pays up to $125/hour, and I'm rapidly approaching age 50, so what were you saying about "medium wage"? Or do you work for Wall Street and make twice that now?

Or maybe you've got the wrong job? Or you don't have a passion for programming? As he said, if you don't have it, you'll burn yourself out and go elsewhere.
interesting, that is all I can say. I see it is made with special focus on javascript, that is definitely welcome. Code looks really awesome.
'Relatively senior' here means 'ostensibly trusted with important tasks in the past'. Both of the creators of this application (I won't say 'founders of this startup' because that's silly) are ex-WePay.
10 minutes? Never give your information to a business that made a mistake like this, ever.

That wasn't merely a "security vulnerability". It was also a demonstration that the people running the business have absolutely no idea what they are doing when it comes to security, privacy, or testing and release processes. (Actually, there is an alternative explanation, which is even worse: they knew and didn't care. I prefer to assume naivety rather than malice.)

Unfortunately, the only sensible action when faced with a business like this is to run away and not look back for a very long time, except perhaps to check who the people responsible were so you can avoid anything else they work on in the near future as well.
anyone knows how does this perform compared to http://ace.ajax.org ?
Man, I really wish I could use this, I code JS, HTML, and CSS all day, and would love to hack on my own editor, but don't have the time to learn lisp or c.

No linux version :(
That's your response to someone (admittedly, poorly) discovering and reporting a security vulnerability in your application? Telling him to "be nice" then dropping his e-mail and face as some kind of stick-waving, threatening gesture?

Congratulations on demonstrating to me and countless others why I shouldn't use any product that you EVER touch. You don't get a pass because you're just two nerds. You have a form with a submit button -- that's where your responsibility as a founder and custodianship of user data begins. Day 1, you're already a liability.

I realize this is a pretty direct attack but I'm appalled and staggered by your behavior in this thread. You launched a service on the public Internet. There is no grace period, there is no "friendly fire"; you fucked up and you disclosed AWS credentials. Not users' favorite colors. AWS KEYS. Tied to credit cards, running servers, S3 backups, God knows what. You don't get to tell people to be nice to you when you're acting as the steward of AWS credentials; you protect them and act like you care when someone tells you that you fucked up doing so.

Your behavior here is just foreboding for the future, and you need to realize that before launching your next endeavor (this one is probably done, after that little mess).
I spend more time on Facebook than I do any other social networking site. I wouldn't be on it if it weren't interesting. My friends aren't on Twitter or G+, I've never intentionally gone on 4chan, and I just go on youtube for the free music and funny clips. Facebook is where it's at, so I also disagree with the author.
For many startups, #1 tactic is to spam the hell out of the social network of your existing users.

The links is laughably bad. It's just a bunch of advertising disguised as an informative post.
This whole idea is repulsive to me, chairman Mao would probably welcome it, but that is all. It is dumb idea made by people who are not interested in solving captcha, but pushing their own vision on how morals should be.
If in the age of internets we can't stand people with differing opinions and all have to be beaten into same mold, then we are really screwed.
Automated Kiosk for Novels? (Redbox for books)
Hi, I wanted to know what some of you thought of an automated kiosk for books. Basically, for a small fee of around $2 a month, you could go to a box, select your novel, then go ahead and read it for as long as you want. I know ebooks are where it's at these days, but I just keep running into people who love and miss the feel of real books, yet find it inconvenient to go to a bookstore or library to get one book. That is why I think placing a kiosk at places people go to all the time, such as super markets, gas stations, street corners, etc, will allow people to come across these machines without having to go out of their way. They will be going to places they normally go to various times a week.
Therefore, I just wanted some feedback on the idea. Would you use it or not? The pricing point would have to be very low, which I think $2 a month is. I feel if it works for DVDs, then it can work for novels, please let let me know what you think! Thanks!
I'm curious, did you let them know that this vulnerability exists before you wrote an article and posted it to HN?

If you let them know and they ignored you, then I understand that you'd want to write an article and spread it around. It's important that customers know when a company doesn't value their security. At that point, the proper way for them to handle it is to quietly fix it, and then let all their affected customers know so they have a chance to change their security settings.

However, if you didn't give them a bit of time first, then you are doing more damage than good to them--and their customers.
EDIT: Guys, don't downvote smeagle's comments. If anything, we should be upvoting them as much as possible so that others can see this blatant disregard for their users

---------

You are quickly making the case for having one of the worst responses I've ever seen, to a huge security flaw. Trying to wipe things under the rug when your users information is clearly exposed is an easy way to destroy trust.

I seriously can't fathom the ineptitude it takes to direct people to someones email like that over your glaring mistake.
Heaven forbid someone learns your highly secretive height, weight, eye color and DL license number which is completely meaningless.

They communication does appear to suck, but your paranoia is unfounded.
You could always make the Linux version!
What OS/Browser are you using? I turned on aggressive caching with CloudFlare to speed up page loads but it appears that it's only serving the gzipped version.
>Good to know we shouldn't have pleasure so long as there is any man who can't share in it.

Sounds as a very good, if difficult to attain, guideline for the improvement of society.

And very close to the original message of Christianity too (I'm talking milleniums ago).
I'm getting the same. Chrome 22/Mac.
This is also the case on Unix. According to Advanced Programming in the Unix Environment, it is true of many of these so-called limits. The POSIX standard defined many values that were too small for modern-day use, such as _POSIX_PATH_MAX set to 255. The non-posix values are not all defined in limits.h, and must be queried at runtime. Even then, some are indeterminate. But at least you're not relegated to 255 characters;)
Many folks in the security community might suggest a) An oblique warning publicly like "There exists a security problem with this; I have mailed the devs" b) actually mailing the devs c) waiting for confirmation of fix or a reasonable time and only then d) tar-and-feather. The term-of-art for this is "responsible disclosure."

This incentivizes people to fix things quickly and preserves the reputational value of breaking into things without researcher-vendor relations getting adversarial when you announce something like "I harvested a couple dozen of your customers' API keys" or "Here's an exploitation roadmap you can follow in your browser" in a public forum.
I have the same problem as the GP, and I'm using Chrome on OSX. Hope it helps.
So I'm used to debugging in Chrome, so I instinctively open the browser's dev tools to find that this breaks the Live Preview. It feels somewhat like there's a quantum property here: things work like magic (the browser is apparently opening a static CSS file from file://), but as soon as you try to observe it, it starts behaving as expected (no live updates for you!). That seems a little bit odd.
i agree - i cant think of a reason why the user id would ever be in the account url
They already knew and it was fixed before I posted this.
Mirror? I can't read download.gz files.
It's just simple business rules.

Is it really that hard for you to tell a fake FB/twitter account from a real one that you couldn't code the logic?

You don't even have to code it. You just need to link it. If someone is reading the review, they can go back to the person that wrote it and judge for themselves.
And did you let them know privately before you posted this comment? http://news.ycombinator.com/item?id=4619411
Might I make one suggestion:

Make sure your SSH port is below 1024 (but still not 22). Reason being if your Linode is ever compromised a bad user may be able to crash sshd and run their own rogue sshd as a non root user since your original port is configured >1024.
we're incredibly sorry about all of this.

honestly, this was all accidental. it was a pet project we started to toy with Glacier and a week later i accidentally hit the Like button sending a ping to my friends on FB. bless my friends for being so influential i guess. shame on us for using Rails carelessly.

if you have any experience with startups, you'll know that 99% of the things you launch go nowhere--this project was no different. we honestly thought our site was of absolutely no consequence. we're truly thankful so many people found it useful, but trust me we're sorry there was a hole.

however, just to be clear:

- about 20 accounts were exposed, including me and my buddy
- i emailed all of them, and wiped out the credentials
- they quickly responded (i saw the updates come in)

thankfully, AWS is designed for such situations. with a few clicks, people deactivated their credentials (both IAM and main account) and regenerated new credentials. the fact that all the early signups were techies who know their way around AWS really saved us.

one more thing: the correct quote is:

"Glacier is built for durability of 99.999999999%"

also: i agree with ryan--don't trust 10-minute old startups :-)
Instprofit when you sell to ZNGA. OMG so easy.
After reading it several times, it seems to me the key paragraph of the article, the one beginning with "Such a program would presumably be an AGI ..." is bullshit.

Anyone else have the same conclusion?
I'm in a second-class tech job market (not in a big city, even), and my skills got me two interviews and a job offer in DAYS.

And I'm in my 40s.

And I've been turning down full-time employee offers for years. Contracting suits me better. That or a "founder" role.

You need to specialize. And to be good at your specialty. Mine has been games for years, but this time I leveraged my Android experience to get a contract doing embedded Linux software.

For the record, my job is "good paying": Nearly $100/hour. And it's hourly, so the one time I had to work a long day to meet a deadline (nearly 10 hours! Oh no!) I got paid for it. :)

So keep your skills fresh and relevant and age doesn't matter -- except in one important way. People will see you and think "this guy has a life, so he isn't going to be pulling constant 12 hour days," and they (foolishly) think that's a drawback. But at least for me, I'd laugh at them for not wanting to hire me -- because I sure-as-hell wouldn't want to work for someone who expected that.
Is there some sort of tool to generate Ascii graphs out there?
Who Made That Escape Key?
Sorry, try again. Misconfiguration on the server was sending out gzipped content without proper headers.
Should be resolved. Can you try once more?
I'd love to see more responses to this - only I'm thinking of py-statsd.
Technically? Nothing. Practically? The inability to sell credit if this kind of policy is pursued. No one is interested in dollars if they have no value.

What stops you from maxing out all the credit you can get and then walking away? Same basic situation. Nothing stops you, but you'll likely end up bankrupt and regardless you'll have a hard time getting credit again.
How is it abandoned if the last build was released two weeks ago and the last commit was four hours ago?
Details of the vulnerability were not posted until it was patched, which was no more than 60 seconds after that initial post.
Everyone here that is thinking of giving this company the benefit of the doubt needs to go read their (smeagle) responses to RKearney from the original thread. Here are some samples of the careless attitude behind this:

----

"if anyone's concerned about your AWS key, just destroy your IAM user and create a new one. that's what it was designed for."

----

In response to advice saying they should notify users by email:

"good idea.
actually, we'll just wipe them and force new ones."

----

In response to RKearney warning people about just what exactly is exposed:

"in case you have issues with your AWS keys. RKearny's email:
ryan@ryankearney.com
https://secure.gravatar.com/avatar/f7d7b021fb488fe6a67ddb286....
"Whoops, we disclosed everybody's AWS credentials. I know! Rather than tell our users, I'll wipe the database and remove all evidence of it ever happening."
You're extrapolating results from 3 months into years? Uh... yeah...

It doesn't sound that easy or stable if you are willing to sell it for 6 months profit instead of using your 5 minutes each year to run it forever and making $900/year.
No, I meant "type", exactly as I wrote it. I was not referring to situations where the programmer accidentally types a character or two incorrectly, without realizing it. I'm talking about cases where the programmer intentionally writes code in a certain way, but does not realize it violates a type constraint of some sort. Maybe he passes a string to a function that expects a numeric value. Or maybe he renames a method, but misses one invocation. You get the idea.

Please don't assume that what was written was wrong, especially when it wasn't.
Sorry, but I think you're being far too kind.

A policy of so-called responsible disclosure is a reasonable approach to take when dealing with an established product/service that contains a minor vulnerability, something potentially dangerous but unlikely to be exploited in the immediate future with serious negative effects.

In this case, we appear to have a new project run by people who don't know what they're doing, with a glaring vulnerability that had presumably already compromised 80+ people's sensitive credentials and in turn who knows what other sensitive information. Bringing it down as fast as humanly possible and loudly so no-one else gets damaged in the meantime is entirely justified in a case like this.
He submitted this article after the vulnerability was already fixed. (I grant that the initial comment came before.) I'd be inclined to agree with you, overall, save for a couple mitigating factors in this case:

1) The founder's behavior in the other thread, including refusing to notify affected parties.

2) Such a simple mistake worries me about what else might be vulnerable in the application which is built to handle users' backup data, and for that reason alone, I think this article is extremely important right now.
Classless. Come on Khang - everyone here wants to root for their fellow entrepreneurs, creators, and (self-proclaimed) "nerds".

RKearny pointed out a very real, very important issue that will help you make your service better, and help you deliver even more value for your users. And he did it for free! You should be thanking him and asking him for more feedback, not deflecting responsibility like this.
Classy response. Now here's your chance to take lemons and make lemonade. Clearly your pet project is something that people find really interesting and useful. So it went public before you intended and had some security flaws: oh well, that's in the past now. Write your mea culpa about how much you learned from this experience, hit the front page of HN again, sign up a bunch of users, and go get some venture capital. Good luck!
I was slightly vague in my oroginal post. I didn't mean "match completely the soruce data", I meant "match a part of the source data", as a standard rsync/Exchange-style block-deduplicator would do.

Per the challenge, it need not work on every file, only the one the challenger chose to provide. If the challenger is not suspecting this attack, he won't know to make sure to pick one of the many source files that are resistant to the attack.

Of course the compression is impossible in general, if the task is sufficiently rigorously described, which it wasn't in this case.
It probably runs under Wine, looking at the binaries it seems to be built against dx9 and gl ES, so it hopefully would default to gl ES if any problems come up.
I'm generally with you, but I do hope that this tarring and feathering will drive home one point:

Don't trust the client.

The user ID in the URL like this is a giant "try editing me and see what happens" sign, even if you came with no intention of providing unsolicited pen testing. I seriously doubt just this one person noticed.
I agree. It's a pretty shallow idea. Is it a terrible thing to be "fascinated" by something that is supposedly terrible? Fascination doesn't actually necessitate a polarized reaction. And, really, exclusionary tactics/gatekeeping with opinions? These seem like awfully short-sighted solutions to a deeper problem.

And, what's more, trolls aren't hard to mobilize if provoked. Start implementing this and I wouldn't doubt seeing a small movement devoted to going the extra mile to offend people with "humane" sensibilities.
I thought this type of living went away with the Grateful Dead. I can see it as some sort of strange counter-culture, but to do it for financial reasons just seems absurd. Unless you are truly destitute, it ultimately carries so many other burdens that will add to the costs.
The answer is because most non-technical co-founders don't bring much to the table. Many don't have startup experience, management experience, fundraising/angel/VC connections.

If you want to tech co-founders to work with you, you need to demonstrate something.
You speak of "responsible disclosure", but what about "responsible launch"?

If a backend is coded this poorly, it betrays irreparable and highly dangerous levels of idiocy, laziness, and lack of foresight in the ones who coded it. Everyone deserves to be informed of this blunder so they know to avoid this group like the plague.

Public ridicule and preemptive destruction of the brand is the only conscionable reaction.
Completely agree. Look at his responses to the security issue being brought up in the original thread [1]. This is someone who is clearly playing fast and loose with some frameworks, and people's information, and does not deserve to be given that consideration.

In his own responses, he says that he won't email the users! I can't imagine how upset I would be if this had my information. Access control for something like this is dead simple

[1]http://news.ycombinator.com/item?id=4619424
I think the bigger problem is that the questions are currently in plain text, which, since they require a human to write and once solved are solved forever, makes the approach as implemented a sort of quixotic reverse captcha.

If they switch to image based questions, the potential problems for human solvers are magnified.
Thanks for sharing. I thought it would be awful, but it was deeply profound in a strange way.
Steve Jobs gives fascinating talk in 1983 at the Center for Design Innovation
Lockitron Sells Over 9000 Units in First Week, Opens Up Orders for Batch 2
I had to look up WePay on Google. The wikipedia page says they have 30 employees as of a year ago, did YC and 1 round of funding.

I have to be honest - that doesn't demonstrate a high level of trust at all these days. It's sad, but true. Plus, if you say they're "ex-WePay," I assume they were just everyday developers for WePay, not critical resources.
Do not go near this software, ever. http://blog.ryankearney.com/2012/10/never-give-your-informat...
Why would I want to use or contribute to this over something like http://codemirror.net/ or the various tools powered by codemirror? (light table, jsbin, etc)

edit: I see that this is also powered by codemirror, the editor itself, so what does this offer on top of it?

I can't even find a feature list on this page, and after signing up for the adobe ~cloud~ I haven't been able to make my way to a working demo of the application...
Ryan, your post is NOT an example of responsible disclosure. You could have written your post and posted it AFTER alerting the Ice Box Pro guys and waiting until they had the main issues fixed. Your post would still be a good post. In fact, you seem to weigh the importance of your post getting on HackerNews above the security of the people who tried Ice Box Pro. The creators of Ice Box Pro had good intentions and messed up security (as almost any startup does to some extend). You are either ignorant to what security actually means or unethical, which at best is as bad as what the creators of Ice Box Pro did and maybe worse. Will you take responsibility if any of the users that tried Ice Box Pro get hacked as a consequence of your post?
Contacted a PR person in between the last thread and this one, I'm guessing? That's a rapid 180.

You have a long way to go in my mind, in terms of fixing the initial response. You probably have help now, which is great, but your initial kneejerk demonstrates underlying trouble to me which you need to fix.

You're in a tough spot, too, because you can't delete those godawful comments without looking suspicious.
No it doesn't.

Choose three words, one each from a group of positive (I like), neutral and negative (I don't like), along with something from a big list of news items which are good or bad.

Now they have to choose (I like + good news) or (I don't like + bad news). Adding new words or new news items are independent of each other, and it doesn't seem that hard compared to traditional captchas.
I used to work in a call center. I'm not female, but I knew a female or two who worked there. There was no dress code. There was aggressive monitoring, but there was a script and the cordial demeanor becomes automatic very quickly. The pay and job security wouldn't justify taking off for a month, though the turnover was high enough that after coming back, if they were still in business you could probably return to work right away.
The rules were certainly unclear on that point.

Mike didn't guarantee to preserve the file metadata. It seems eminently defensible for him to say that he was dealing in files, not filesystems, so he could rename the file upon receipt. In fact, the EOF-hack in Craig's solution turned on the assumption that the filesystem could be hacked by the challengee, so it seems fair to allow the challenger to hack the filesystem as well.
It sounds like it wasn't launched yet. The founders say they built it for themselves and their friends to start. Someone discovered the URL and posted it to Hacker News.

They probably should have shut it down or disabled registrations once it got out until it was tested.